Skip to content
OpenAdvisories

Vendor

hasura

6 known vulnerabilities.

Products

Hasura GraphQL 3 graphql-engine 2 GraphQL 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.0
    CVE-2026-54698

    Hasura: Row-level authorization bypass on table computed fields

    Hasura is an open-source product that provides users GraphQL or REST APIs. Prior to 2.49.2 and 2.45.5, a user can use a where clause on a table computed field (returning SETOF some_table) to infer row values that ought to be filtered for their role based on s…

    hasura graphql-engine
  • Medium 5.3
    CVE-2021-47715

    Hasura GraphQL 1.3.3 Server-Side Request Forgery via Remote Schema Injection

    Hasura GraphQL 1.3.3 contains a server-side request forgery vulnerability that allows attackers to inject arbitrary remote schema URLs through the add_remote_schema endpoint. Attackers can exploit the vulnerability by sending crafted POST requests to the /v1/…

    hasura Hasura GraphQL
  • Medium 5.5
    CVE-2021-47714

    Hasura GraphQL 1.3.3 Local File Read via SQL Injection

    Hasura GraphQL 1.3.3 contains a local file read vulnerability that allows attackers to access system files through SQL injection in the query endpoint. Attackers can exploit the pg_read_file() PostgreSQL function by crafting malicious SQL queries to read arbi…

    hasura Hasura GraphQL